R Package Script Injection Vulnerability in Sonatype Nexus Repository

CVE-2026-97667

What is CVE-2026-97667?

Sonatype Nexus Repository 3 has a vulnerability allowing users with edit permissions on hosted R repositories to inject script content into the metadata of R packages. This injected script executes within the browser of any user who views the package details, leveraging their permissions. This poses significant risks, particularly when anonymous user access is enabled and permissions are not tightly controlled, as potentially harmful scripts can be executed without the user's knowledge.

References